Tag: malicious
-
Chinese Developer Jailed for Deploying Malicious Code at US Company
A Chinese developer has been sentenced to four years in prison after being found to deploy malicious code in his employer’s network, including a “kill switch” First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-developer-malicious-code-us/
-
New Android Spyware Masquerading as Antivirus Targets Business Executives
Doctor Web’s antivirus laboratory has identified a sophisticated Android backdoor malware, designated Android.Backdoor.916.origin, which has been evolving since its initial detection in January 2025. This multifunctional spyware primarily targets representatives of Russian businesses through targeted attacks rather than mass distribution. Attackers disseminate the malicious APK file via private messages in popular messengers, disguising it as…
-
Unmasking KorPlug Malware: TTPs, Control Flow, and Exposed IOCs
As part of the ongoing analysis of the KorPlug malware family, this second installment focuses on the complex second-stage payload, expanding on earlier discoveries of DLL side-loading methods that use legitimate programs to execute code initially. The payload, a malicious DLL with SHA-256 hash b6b239fe0974cf09fe8ee9bc5d0502174836a79c53adccdbb1adeb1f15c6845c, measures 638,976 bytes (624 KB) and is structured as an…
-
Hackers Abuse Python eval/exec Calls to Run Malicious Code
Threat actors are increasingly abusing native evaluation and execution functions to conceal and execute malicious payloads within innocent-looking packages on PyPI. Security researchers warn that while static analysis libraries such as hexora can detect many obfuscation techniques, attackers continue innovating ways to slip harmful code past simple scanners. Supply chain attacks targeting Python packages have surged, with…
-
Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
The advanced persistent threat (APT) actor known as Transparent Tribe has been observed targeting both Windows and BOSS (Bharat Operating System Solutions) Linux systems with malicious Desktop shortcut files in attacks targeting Indian Government entities.”Initial access is achieved through spear-phishing emails,” CYFIRMA said. “Linux BOSS environments are targeted via weaponized .desktop First seen on thehackernews.com…
-
Critical Tableau Server Flaws Allows Malicious File Uploads
Salesforce has addressed multiple critical security vulnerabilities in Tableau Server and Desktop that could enable attackers to upload malicious files and execute arbitrary code. The vulnerabilities, disclosed on August 22, 2025, were proactively identified during a security assessment and patched in the July 22, 2025 maintenance release. Critical Type Confusion Vulnerability The most severe flaw, CVE-2025-26496,…
-
10 Best Web Content Filtering Solutions 2025
In the modern digital landscape, web content filtering is a fundamental component of cybersecurity and network management. A web content filtering solution is a technology that controls and monitors the web pages, URLs, and IP addresses that users can access. These tools protect organizations by preventing access to malicious sites, blocking inappropriate content, and enforcing…
-
Malicious Go Module Poses as SSH Brute-Force Tool, Steals Credentials via Telegram Bot
Cybersecurity researchers have discovered a malicious Go module that presents itself as a brute-force tool for SSH but actually contains functionality to discreetly exfiltrate credentials to its creator.”On the first successful login, the package sends the target IP address, username, and password to a hard-coded Telegram bot controlled by the threat actor,” Socket researcher Kirill…
-
Hackers Could Take Over Apple Devices Via Malicious Images Patch Now!
Apple fixes CVE-2025-43300, a flaw letting hackers hijack devices via malicious images. Users urged to update iPhone, iPad,… First seen on hackread.com Jump to article: hackread.com/hackers-take-over-apple-devices-malicious-images-patch/
-
GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets
Tags: attack, botnet, crypto, cve, cybercrime, cybersecurity, exploit, iot, malicious, vulnerabilityCybersecurity researchers are calling attention to multiple campaigns that leverage known security vulnerabilities and expose Redis servers to various malicious activities, including leveraging the compromised devices as IoT botnets, residential proxies, or cryptocurrency mining infrastructure.The first set of attacks entails the exploitation of CVE-2024-36401 (CVSS score: 9.8), a critical First seen on thehackernews.com Jump to…
-
Blue Locker ransomware hits critical infrastructure is your organisation ready?
Critical infrastructure organisations are once again being warned of the threat posed by malicious cybercriminals, following a ransomware attack against a state-owned energy company in Pakistan. First seen on exponential-e.com Jump to article: www.exponential-e.com/blog/blue-locker-ransomware-hits-critical-infrastructure-is-your-organisation-ready
-
ReVault Flaw Exposed Millions of Dell Laptops to Malicious Domination
A bug in the control board that connects peripheral devices in commonly used Dell laptops allowed malicious access all the way down to the firmware running on the device chip, new research finds. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/revault-compromised-secure-soc
-
Operation Serengeti 2.0: INTERPOL nabs 1,209 cybercriminals in Africa, seizes $97M
INTERPOL arrested 1,209 cybercriminals in 18 African nations seizing $97.4M, and dismantling 11,432 malicious infrastructures. INTERPOL announced the result of the second phase of ongoing law enforcement Operation Serengeti (June to August 2025) that led to 1,209 arrests across 18 nations in Africa. The authorities are aiding 88,000 victims, seizing $97.4M, and dismantling 11,432 cybercrime…
-
AI Models Resize Photos and Open Door to Hacking
Researchers Show How AI Image Downscaling Can be an Attack Vector. Researchers discovered a method to embed invisible prompt injections that are activated during AI’s processing of an image. When the model scales down these images, the hidden malicious instructions allow theft of data from popular image production systems. First seen on govinfosecurity.com Jump to…
-
Interpol-led crackdown disrupts cybercrime networks in Africa that caused $485 million in losses
Operation Serengeti 2.0 dismantled almost 11,500 malicious infrastructures between June and August. Officials arrested more than 1,200 alleged cybercriminals. First seen on cyberscoop.com Jump to article: cyberscoop.com/interpol-operation-serengeti-2-africa/
-
Help TDS Hacks Legitimate Websites, Using PHP Templates to Display Fake Microsoft Security Alerts
GoDaddy Security researchers have unveiled a detailed analysis of Help TDS, a sophisticated Traffic Direction System operational since at least 2017, which exploits compromised websites to funnel traffic toward malicious scams. This operation supplies affiliates with PHP code templates that are injected into legitimate sites, primarily WordPress installations, to redirect visitors to fraudulent pages mimicking…
-
Help TDS Hacks Legitimate Websites, Using PHP Templates to Display Fake Microsoft Security Alerts
GoDaddy Security researchers have unveiled a detailed analysis of Help TDS, a sophisticated Traffic Direction System operational since at least 2017, which exploits compromised websites to funnel traffic toward malicious scams. This operation supplies affiliates with PHP code templates that are injected into legitimate sites, primarily WordPress installations, to redirect visitors to fraudulent pages mimicking…
-
Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection
Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell.The “Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file,” Trellix researcher Sagar Bade said in a technical write-up.”The payload isn’t hidden inside the file content or a…
-
Developer gets prison time for sabotaging former employer’s network with a ‘kill switch’
The ex-developer was convicted of planting malicious code designed to crash its servers in the event that he was fired. First seen on techcrunch.com Jump to article: techcrunch.com/2025/08/22/developer-gets-prison-time-for-sabotaging-former-employers-network-with-a-kill-switch/
-
Featured Chrome extension FreeVPN.One caught capturing and transmitting user data
Tags: access, api, browser, ceo, chrome, corporate, credentials, data, data-breach, endpoint, finance, governance, healthcare, india, malicious, mobile, monitoring, privacy, risk, technology, threat, tool, vpn, vulnerability, vulnerability-managementUnmanaged extensions expose enterprises: Such incidents highlight how unmanaged browser extensions can act as covert data exfiltration channels, exposing sensitive corporate information. Enterprises usually deploy licensed, corporate-grade VPNs that are safe and accompanied by monitoring and access controls. But employees often install free VPN extensions for personal use.”This poses as a major threat to industries…
-
Chinese national who sabotaged Ohio company’s systems handed four-year jail stint
A Houston resident was sentenced to four years in prison for intentionally installing malicious code on his employer’s computer systems, which he activated when his role was terminated. First seen on therecord.media Jump to article: therecord.media/chinese-national-sentenced-prison
-
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Cybersecurity researchers are calling attention to malicious activity orchestrated by a China-nexus cyber espionage group known as Murky Panda that involves abusing trusted relationships in the cloud to breach enterprise networks.”The adversary has also shown considerable ability to quickly weaponize N-day and zero-day vulnerabilities and frequently achieves initial access to their targets by First seen…
-
INTERPOL Arrests 1,209 Cybercriminals Across 18 African Nations in Global Crackdown
INTERPOL on Friday announced that authorities from 18 countries across Africa have arrested 1,209 cybercriminals who targeted 88,000 victims.”The crackdown recovered $97.4 million and dismantled 11,432 malicious infrastructures, underscoring the global reach of cybercrime and the urgent need for cross-border cooperation,” the agency said.The effort is the second phase of an ongoing law First seen…
-
Hackers Target Phones of Military-Linked Individuals in South Asia Using New Spy Tools
Cyber threat actors have launched sophisticated phishing operations aimed at military and government personnel in South Asia, leveraging defense-related lures to distribute malicious archives and applications. Recent detections include ZIP files like >>Coordination of the Chief of Army Staff’s Visit to China.zip,
-
Malicious PDFs in Play: UAC-0057 Leveraging Invitations to Trigger Shell Script Attacks
The Belarusian-affiliated threat actor UAC-0057, also known as UNC1151, FrostyNeighbor, or Ghostwriter, has been using weaponized archives that contain phony PDFs that are posing as official invitations and documents to target organizations in Poland and Ukraine in a sophisticated cyber espionage campaign. Since April 2025, these operations have utilized compressed archives, such as RAR and…
-
Interpol operation seizes $97 million in African cybercrime sweep
Authorities in Africa have arrested 1,209 people in an Interpol-led crackdown on cybercrime that targeted nearly 88,000 victims. 11,432 malicious infrastructures were … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/22/interpol-africa-cybercrime-crackdown/